Skip to content

Sanctions screening

The geo-block stops ingress from sanctioned countries at the edge. Sanctions screening is the second layer: a name/email/handle check on every signup that catches the case where a designated individual travels, uses a VPN, or signs up through a non-sanctioned-country proxy. It runs on both the standard signup form and the OAuth registration flow.

The screening runs against the OFAC SDN list (with EU / UK / UN list support).

Why both layers

OFAC's comprehensive-sanctions regimes are strict-liability. A single accepted signup or payment from a designated person is a criminal-law violation. The geo-block is the always-on defence; sanctions screening is the secondary layer:

  • A designated individual travelling abroad and signing up from a hotel Wi-Fi in a non-sanctioned country.
  • A designated individual using a commercial VPN that exits in Armenia or Singapore.
  • A designated individual signing up via OAuth (Google / GitHub) from a non-sanctioned IP, where the only signal we have is the email handle or display name.

The full list of sanctioned jurisdictions is in Geographic restrictions → Blocklist.

List source

The screening matches against the OFAC SDN list. Source: https://ofac.treasury.gov/sanctions-list-service

The EU consolidated list and the UK HMT consolidated list are also supported.

Refresh cadence

OFAC SDN: refresh daily. MaxMind GeoLite2: weekly. EU / UK consolidated: as published (typically monthly). Restart the gateway after each CSV update to pick up the new file.

Screening logic

For each signup the screening runs:

  1. Normalise the name and email (catches full-width homoglyphs like ＡＢＣ → ABC) and lower-case them.
  2. Tokenise on whitespace and non-alphanumeric characters.
  3. Drop short noise — tokens shorter than 3 characters are skipped (so Mr., de, la, Jr. do not contribute).
  4. Match — if any token of the name or the email appears in the SDN token set, the signup is rejected.

The matching is intentionally aggressive. False positives are cheap (rejected signup, the user retries with a different email); false negatives carry regulatory exposure.

Screen outcomes

The screening returns one of three results:

Result Meaning What happens
Clean No SDN token matched. Allow signup.
Match The name or email contained a known SDN token. Reject with 403. The matched display name and the field that hit are logged at WARN for audit.
Degraded Screening ran but the table is the hand-curated fallback (CSV missing or unparseable). Allow signup. A separate WARN log + an ops-counter flag the misconfiguration. The geo-block is still on — the IP-level defence is intact.

On a Match the response body is a generic 403 — the matched display name is not echoed to the client to avoid confirming the screening target.

Known limitations

  • Cyrillic / Latin homoglyphs are NOT collapsed. A Cyrillic а stays Cyrillic after normalisation; only the full-width Latin / ASCII cases collapse. A designated individual could circumvent name-based screening by transliterating their name to a homoglyph script. A non-Latin name from a sanctioned-country IP is still blocked by the geo-block.
  • No email-domain match. Emails are tokenised on @ and ., but the resulting tokens (e.g. gmail, mail) are common enough that matching them would produce false positives. The name tokens are the primary signal; the email is a secondary, weaker signal.